Privacy Policy

1.Scope of This Policy

1.1What This Policy Covers. This Privacy Policy applies to personal information that smartSTAT collects (a) through the Website, including our contact form; (b) about individuals who use the Services on behalf of a customer ("Users"), such as account and activity information; and (c) in the course of our business dealings with customers, prospective customers, and vendors, such as business contact information.

1.2What This Policy Does Not Cover. This Privacy Policy does not cover personal information handled by our customers, including hospitals and health systems, under their own privacy notices and policies, or third-party websites and services that we do not control.

1.3Related Terms. Use of the Services is also governed by any terms of service we publish on the Website and, where applicable, by a signed agreement between smartSTAT and the customer (a "Customer Agreement").

2.Our Role: Customer Data

2.1We Act on Behalf of Our Customers. When a hospital, health system, or other organization (a "Customer") uses the Services, the data submitted to or generated in the Services by or for that Customer ("Customer Data") belongs to the Customer. smartSTAT processes Customer Data as a service provider on the Customer's behalf, under the Customer Agreement and the Customer's instructions, and not for our own purposes except as described in Section 5.3 (aggregated and de-identified data) and Article 8 (security).

2.2Your Organization Controls Your Account. If you use the Services through your employer or another organization, that organization decides what data is entered into the Services, who can access it, and how long it is kept. Your organization's administrators can access, change, and remove your account and the information associated with it. Questions about how your organization uses the Services should be directed to your organization.

2.3If This Policy and a Customer Agreement Differ. If a Customer Agreement or a Business Associate Agreement addresses how smartSTAT handles that Customer's data, that agreement controls over this Privacy Policy.

3.Information We Collect

3.1Contact Form and Direct Communications. When you contact us through the Website contact form, we collect your name, email address, organization, role, and the contents of your message. When you email or call us, we collect your contact details and the contents of the communication. We use this information only to respond to your inquiry and to continue the conversation you started, such as scheduling a demo or discussing a pilot.

3.2Account Information. When a Customer sets up the Services, we collect information about Users provided by the Customer or by Users themselves, such as name, work email address, job title or role, facility or department, phone number, and account credentials or identifiers. Depending on how a Customer has configured the Services, Users sign in either through their organization's single sign-on service, in which case smartSTAT does not receive or store User passwords, or with credentials issued for the Services, which we store only in protected (hashed) form.

3.3Platform Activity and Audit Information. When you use the Services, we record information about your activity to operate the Services, maintain audit trails that Customers rely on for compliance, and keep the Services secure. This can include sign-in and sign-out events, actions you take in the Platform (such as checking, restocking, or updating a code cart record), the time of each action, and the IP address and device or browser used.

3.4Hardware and Operational Data. Our carts, handheld devices, RFID readers, RFID tags, and related hardware collect operational information about code carts and their contents, such as item identifiers, lot numbers, expiration dates, inventory counts, cart status, device health, and the location of carts and devices within a Customer's facility. This information is about equipment and supplies. It is associated with an individual only where the Platform records which User performed an action, as described in Section 3.3.

3.5Support Information. When you request support, we collect the information you provide, such as your contact details, a description of the issue, screenshots, and related logs.

3.6Technical Information. When you visit the Website or use the Services, our systems automatically record technical information, such as IP address, browser type, operating system, referring page, pages visited, and date and time of access, in server and security logs.

3.7Business Contact Information. We collect business contact information about representatives of Customers, prospective customers, vendors, and partners in the ordinary course of doing business with them, including information exchanged in contracts, invoices, and correspondence.

4.Protected Health Information

4.1The Services are designed to manage code cart, supply, and equipment information, and are not intended to receive, store, or process protected health information ("PHI") as defined under the Health Insurance Portability and Accountability Act of 1996 and its implementing regulations ("HIPAA"). Customers and Users should not enter PHI into the Services unless the Customer and smartSTAT have signed a Business Associate Agreement ("BAA"). Where a BAA is in place, smartSTAT uses and discloses PHI only as permitted by the BAA and HIPAA, and the BAA controls over this Privacy Policy with respect to PHI.

5.How We Use Information

5.1Purposes. We use personal information to:

1. (a) provide, operate, maintain, and support the Services, including authenticating Users and keeping audit trails;
2. (b) respond to inquiries, demo requests, and support requests;
3. (c) communicate with Customers and Users about the Services, including service announcements, maintenance notices, security notices, and changes to our terms and policies;
4. (d) protect the security and integrity of the Services, including detecting, investigating, and preventing security incidents, fraud, and misuse;
5. (e) monitor and improve the performance, reliability, and features of the Services;
6. (f) administer our business relationships, including contracting, invoicing, and account management; and
7. (g) comply with legal obligations, enforce our agreements, and establish, exercise, or defend legal claims.

5.2No Marketing Use of Contact Form Information. We do not add people who contact us through the Website to marketing mailing lists or use contact form information for marketing unless you ask us to or separately agree to it. Any marketing email we send will include a way to unsubscribe.

5.3Aggregated and De-identified Data. We may create aggregated and de-identified data from information we process, including Customer Data, to operate, secure, and improve our products and services. This data will not identify any Customer, User, or patient, and we will not attempt to re-identify it.

5.4No Automated Decisions. We do not use personal information to make decisions that produce legal or similarly significant effects about individuals based solely on automated processing.

6.How We Disclose Information

6.1When We Disclose Information. We disclose personal information only as follows:

1. (a) To the Customer. Information about Users and their activity in the Services is available to the Customer that provided their access, including its administrators.
2. (b) To service providers. We use carefully selected service providers, such as cloud hosting (in the United States), email delivery, and customer support tools, to help us operate the Services and our business. They may use personal information only to provide services to us, and are bound by written obligations to protect it. A list of our current subprocessors is available to Customers on request.
3. (c) For legal reasons. We may disclose information when we believe in good faith that it is required by law, subpoena, or court order, or is necessary to protect the rights, property, or safety of smartSTAT, our Customers, patients, or others. Where legally permitted, we will notify the affected Customer before disclosing Customer Data in response to a legal demand.
4. (d) In a business transfer. If smartSTAT is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to the commitments in this Privacy Policy and any Customer Agreement.
5. (e) With consent. We may disclose information for other purposes with the consent of the individual or, for Customer Data, at the Customer's direction.

6.2No Sale or Targeted Advertising. smartSTAT does not sell personal information, and does not share personal information for cross-context behavioral advertising or targeted advertising, as those terms are defined under applicable U.S. state privacy laws. We have not done so in the past twelve (12) months.

7.Cookies and Similar Technologies

7.1What We Use. The Website and the Platform use cookies and similar technologies that are necessary for them to function and to stay secure, such as cookies that keep you signed in, remember your preferences, balance traffic, and protect against fraudulent or malicious requests.

7.2Analytics and What We Do Not Use. The Website may use basic analytics that tell us how many people visit and which pages they view, so we can improve the Website. We do not use advertising cookies, tracking pixels, or third-party tracking technologies that follow you across other websites, and we do not use analytics information to identify you. If we add other non-essential technologies in the future, we will update this Privacy Policy first and, where required by law, ask for your consent.

7.3Your Browser Settings and Signals. You can set your browser to block or delete cookies, but parts of the Website and Platform may not work without necessary cookies. Because we do not engage in cross-site tracking, sale, or targeted advertising, we honor browser privacy signals such as Global Privacy Control by default, and no additional action is needed.

8.Security

8.1smartSTAT maintains administrative, technical, and physical safeguards designed to protect personal information, appropriate to the nature of the information and the risks involved. These safeguards include encrypting data in transit, limiting access to personal information to personnel and service providers who need it, logging access to the Services, and procedures for responding to security incidents. We review and strengthen these safeguards as the Services and our company grow. No method of transmission or storage is completely secure, but we work to protect information and to improve our safeguards over time. If we become aware of a security incident affecting Customer Data, we will notify the affected Customer as required by the Customer Agreement, any BAA, and applicable law. You can report a suspected security issue to info@smartstat.io.

9.Your Privacy Rights

9.1Customer Data. If your personal information is part of Customer Data, such as your User account and activity in the Services, please direct requests to access, correct, or delete it to your organization, which controls that data. If we receive a request directly, we will forward it to the relevant Customer promptly, and in any event within five (5) calendar days, and assist the Customer in responding as required by the Customer Agreement.

9.2Other Information. For personal information that smartSTAT controls, such as contact form submissions and business contact information, you may ask us to:

1. (a) confirm whether we process your personal information and provide access to it or a copy of it;
2. (b) correct inaccurate personal information;
3. (c) delete your personal information, subject to exceptions allowed by law; and
4. (d) stop sending you marketing communications, if any.

9.3State Privacy Laws. Depending on where you live, including California, Colorado, Connecticut, Virginia, and other U.S. states with comprehensive privacy laws, you may have additional rights, such as the right to know the categories of personal information we collect, the sources, the purposes, and the categories of recipients, which are described in Articles 3, 5, and 6 of this Privacy Policy. You may also have the right to opt out of the sale of personal information, targeted advertising, and certain profiling. As explained in Section 6.2, we do not engage in those activities.

9.4How to Make a Request. To make a request, email info@smartstat.io or write to us at the address in Article 15. We will verify your request using information we already have, such as by confirming your email address, and will respond within forty-five (45) days, or within any shorter period required by law. You may use an authorized agent to make a request on your behalf, and we may ask the agent for proof of authorization. If we deny your request, you may appeal by replying to our decision, and we will respond to your appeal within the period required by law.

9.5No Discrimination. We will not discriminate against you for exercising any of your privacy rights.

10.Data Location

10.1smartSTAT is based in the United States. The Services are hosted in the United States, and Customer Data is stored and processed in the United States. The Website and the Services are intended for use by organizations and individuals in the United States. If you access them from outside the United States, your information will be transferred to, stored, and processed in the United States.

11.Data Retention

11.1General Rule. We keep personal information only as long as needed for the purposes described in this Privacy Policy, to comply with our legal and contractual obligations, to resolve disputes, and to enforce our agreements.

11.2Specific Periods. In particular:

1. (a) Customer Data is kept for the duration of the Customer's subscription. For thirty (30) days after the subscription ends, it remains available for export at the Customer's request. We then delete it from production systems within ninety (90) days, and from backups according to our standard backup rotation, unless the Customer Agreement, a BAA, or law requires otherwise.
2. (b) Contact form submissions and related correspondence are kept while we are in discussions with you and for up to twenty-four (24) months after our last communication, unless they become part of a Customer relationship.
3. (c) Security and audit logs are kept for at least one (1) year to support security monitoring, incident investigation, and audits.
4. (d) Business and financial records, such as contracts and invoices, are kept as required by law, generally for seven (7) years.

12.Children

12.1The Website and the Services are intended for business use by adults and are not directed to children. We do not knowingly collect personal information from children under the age of 16. If you believe a child has provided us with personal information, please contact us, and we will delete it.

13.Third-Party Websites and Services

13.1The Website and the Services may contain links to, or integrations with, third-party websites and services, such as a Customer's identity provider or our LinkedIn page. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

14.Changes to This Privacy Policy

14.1We may update this Privacy Policy from time to time. Each version is identified by a version number and effective date, and the current version is always available at smartstatsystems.com/privacy. If we make a material change, we will notify Customer administrators by email or through the Platform at least thirty (30) days before it takes effect, unless a shorter period is required by law. We will not use personal information in a materially different way from what we described when it was collected without providing notice and, where required by law, obtaining consent. Prior versions are available on request.

15.Contact Us

15.1If you have questions about this Privacy Policy or our privacy practices, or wish to make a request, please contact: